﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="The !findthreads extension displays summary information about one or more threads on the target system based on supplied search criteria."/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>!findthreads</title>



<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(2346);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/_findthreads.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="_findfilelockowner.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="_for_each_process.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugger_reference.htm">Debugger Reference</A> &gt; <A href="debugger_commands.htm">Debugger Commands</A> &gt; <A href="kernel_mode_extensions.htm">Kernel-Mode Extension Commands</A> &gt; </div>
	<div id="winchm_template_title">!findthreads</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>The !findthreads extension displays summary information about one or more threads on the target system based on supplied search criteria. Thread information will be displayed when the associated stack(s) reference the supplied object. This command can be used only during kernel-mode debugging.</p>
<p>Syntax</p>
<pre class="syntax"><b>!findthreads </b>[<b>-v</b>][<b>-t  &lt;Thread Address&gt;</b>|<b>-i &lt;IRP Address&gt;</b>|<b>-d &lt;Device Address&gt;</b>|( <b>-a &lt;Pointer Address&gt;</b> <b>-e &lt;End Address&gt;</b> | <b>-l &lt;Range Length&gt;</b>)]<b> </b></pre>
<h2><a id="ddk__thread_dbg"></a><a id="DDK__THREAD_DBG"></a>Parameters</h2>
<p></p>
<dl>
<dt><a id="_______-v______"></a><a id="_______-V______"></a>       <b>-v</b>      </dt>
<dd>
<p>Displays verbose information on all criteria matches.
</p>
</dd>
<dt><a id="_______-t_Thread_Address______"></a><a id="_______-t_thread_address______"></a><a id="_______-T_THREAD_ADDRESS______"></a>       <b>-t</b><b> </b><i>Thread Address</i>      </dt>
<dd>
<p>  The search criteria will be all modules, wait objects, and IRPs for
         the thread, as well as device objects and modules generated from the
         attached IRPs.  This option  will generally provide the broadest search
         criteria.
</p>
</dd>
<dt><a id="_______-i_IRP_Address____________"></a><a id="_______-i_irp_address____________"></a><a id="_______-I_IRP_ADDRESS____________"></a>       <b>-i</b><b> </b><i>IRP Address</i>            </dt>
<dd>
<p>The search criteria will be all modules and devices for the indicated
         IRP, as well as any reference to the IRP itself.
</p>
</dd>
<dt><a id="_______-d_Device_Address____________"></a><a id="_______-d_device_address____________"></a><a id="_______-D_DEVICE_ADDRESS____________"></a>       <b>-d</b><b> </b><i>Device Address</i>            </dt>
<dd>
<p>         The search criteria will be based from the device object.  This will
         include the module associated with the device object (through the driver
         object), the device extension, any IRP attached to the device, and
         similar information for any attached to the device object.
</p>
</dd>
<dt><a id="_______-a_Pointer_Address____________"></a><a id="_______-a_pointer_address____________"></a><a id="_______-A_POINTER_ADDRESS____________"></a>       <b>-a</b><b> </b><i>Pointer Address</i>            </dt>
<dd>
<p>         Add a base address to the criteria.  If -e or -l is correctly specified,
         this value will be the base of a memory range.  Otherwise it is interpreted
         as a pointer.
</p>
</dd>
<dt><a id="_______-e_End_Address____________"></a><a id="_______-e_end_address____________"></a><a id="_______-E_END_ADDRESS____________"></a>       <b>-e</b><b> </b><i>End Address</i>            </dt>
<dd>
<p> Specifies the end address of the memory range specified with -a.
</p>
</dd>
<dt><a id="_______-l_Range_Length______"></a><a id="_______-l_range_length______"></a><a id="_______-L_RANGE_LENGTH______"></a>       <b>-l</b><b> </b><i>Range Length</i>      </dt>
<dd>
<p> Specifies the length of the memory range specified with -a.
</p>
</dd>
</dl>
<h3><a id="DLL"></a><a id="dll"></a>DLL</h3>
<table>
<tr>
<td>
<p><b>Windows 10 and later
         </b></p>
</td>
<td>
<p>
          Kdexts.dll
         </p>
</td>
</tr>
</table>
<p> </p>
<h3><a id="Additional_Information"></a><a id="additional_information"></a><a id="ADDITIONAL_INFORMATION"></a>Additional Information</h3>
<p>For information about threads in kernel mode, see <a href="#Bookmark1375">Changing Contexts</a>. For more information about analyzing processes and threads, see <i>Microsoft Windows Internals</i>, by Mark Russinovich and David Solomon. (This book may not be available in some languages and 

countries.)</p>
<h2>Remarks</h2>
<p>Here is example output  using the -v and -t options:</p>
<pre class="syntax" xml:space="preserve"><code>kd&gt; !findthreads -v -t ffffd001ee29cdc0

Added criterion for THREAD 0xffffd001ee29cdc0
  Added criterion for THREAD STACK 0xffffd001ee2bac20
  ERROR: Object 0xffffffffffffffe0 is not an IRP
ERROR: unable to completely walk thread IRP list.
  Added criterion for MODULE kdnic(0xfffff80013120000)

Found 63 threads matching the search criteria

Found 6 criteria matches for THREAD 0xffffe0016a383740, PROCESS 0xffffe0016a220200
  Kernel stack location 0xffffd001f026a0c0 references THREAD 0xffffd001ee29cdc0
  Kernel stack location 0xffffd001f026a418 references THREAD 0xffffd001ee29cdc0
  Kernel stack location 0xffffd001f026a460 references THREAD 0xffffd001ee29cdc0
  Kernel stack location 0xffffd001f026a4d0 references THREAD 0xffffd001ee29cdc0
  Kernel stack location 0xffffd001f026a4f0 references THREAD 0xffffd001ee29cdc0
  Kernel stack location 0xffffd001f026a670 references THREAD 0xffffd001ee29cdc0


    ffffd001f026a0e0 nt!KiSwapContext+76
    ffffd001f026a190 nt!KiSwapThread+1c8
    ffffd001f026a220 nt!KiCommitThreadWait+148
    ffffd001f026a2e0 nt!KeWaitForMultipleObjects+21e
    ffffd001f026a800 nt!ObWaitForMultipleObjects+2b7
    ffffd001f026aa80 nt!NtWaitForMultipleObjects+f6
    000000c8d220fa98 nt!KiSystemServiceCopyEnd+13
    000000c8d220fa98 ntdll!ZwWaitForMultipleObjects+a
... 

</code></pre></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
